Systems and methods for AAA-traffic management information sharing across cores in a multi-core system

• US 8,667,575 B2
• Filed: 12/22/2010
• Issued: 03/04/2014
• Est. Priority Date: 12/23/2009
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Kumar, Arkesh, Li, Rui, Thakur, Ravindranath, Agarwal, Puneet
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Kabir, Jahangir
• Application Number:
  US12/976,688
• Publication Number:
  US 20110154443A1
• Time in Patent Office: 1,168 Days
• Field of Search: 726/2, 726/3, 726/12, 726/4, 726/5
• US Class Current: 726/12
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers

Abstract

A method for propagating authentication session information to a plurality of cores of a multi-core device includes establishing, by an authentication virtual server executing on a first core of a device intermediary to at least one client and server, a session for a user, the authentication virtual server authenticating the session. A traffic management virtual server executes on a second core of device, and receives a request to access a server via the session. The traffic management virtual server may identify, responsive to a determination that the session is not stored by the second core, from an identifier of the session that the first core established the session. The second core may send to the first core a request for data for the session identified by the identifier. The second core may receive from the first core a response to the second request identifying whether the session is valid.

Claims

1. A method of propagating authentication session information to a plurality of cores of a multi-core device, the method comprising:

a) establishing, by an authentication virtual server executing on a first core of a plurality of cores of a device intermediary to a plurality of clients and one or more servers, a session for a user, the authentication virtual server authenticating the user via a challenge request prior to establishing the session;

b) receiving, by a traffic management virtual server executing on a second core of the plurality of cores, a first request to access a server of the one or more servers via the session;

c) identifying, by the traffic management virtual server responsive to a determination that the session is not stored by the second core, from an identifier of the session that the first core established the session, the determination comprising decoding a core identifier encoded in the identifier of the session, the core identifier identifying the first core and not the second core;

d) sending, by the second core to the first core, a second request for data for the session identified by the identifier; and

e) receiving, by the second core from the first core, a response to the second request, the response identifying whether the session is valid based on a search of the identifier of the session among identifiers that are valid in the device.

2. The method of claim 1, wherein step (a) further comprises setting, by the authentication virtual server, a cookie for the session, the cookie comprising a domain session cookie.

3. The method of claim 1, wherein step (c) further comprises determining, by the traffic management virtual server, that the session is not stored in memory local to the second core.

4. The method of claim 1, wherein step (c) further comprises decoding, by the second core, the core identifier of the first core encoded in the identifier of the session, and identifying the first core as an owner core of the session.

5. The method of claim 1, wherein step (d) comprises generating, by the second core, a core-to-core message specifying the identifier of the session.

6. The method of claim 1, wherein step (e) further comprises receiving, by the second core from the first core, the response comprising a failure message identifying that the first core determined the identifier of the session is invalid.

7. The method of claim 1, wherein step (e) further comprises receiving, by the second core from the first core, the response comprising data to create the session on the requesting core.

8. The method of claim 7, further comprising creating, by the second core, the session in memory local to the second core.

9. The method of claim 7, further comprising determining, by the second core, that a cookie for the session received from the first core, is invalid and responsive to the determination, sending a redirect to the authentication virtual server.

10. The method of claim 1, wherein step (e) further comprises receiving, by the second core from the first core, the response comprising a successful message and responsive to the successful message, performing a local session lookup using the identifier of the session.

11. A system for propagating authentication session information via a plurality of cores of a multi-core device, the system comprising:

a device intermediary to a plurality of clients and one or more servers, the device comprising a plurality of cores;

an authentication virtual server executing on a first core of the plurality of cores establishing a session for a user, the authentication virtual server authenticating the user via a challenge request prior to establishing the session;

a traffic management virtual server, executing on a second core of the plurality of cores, receiving a first request to access a server of the one or more servers via the session, and identifying, responsive to a determination that the session is not stored by the second core, from an identifier of the session that the first core established the session, the determination comprising decoding a core identifier encoded in the identifier of the session, the core identifier identifying the first core and not the second core;

wherein the second core sends to the first core, a second request for data for the session identified by the identifier; and

receives from the first core, a response to the second request, the response identifying whether the session is valid based on a search of the identifier of the session among identifiers that are valid in the device.

12. The system of claim 11, wherein the authentication virtual server sets a cookie for the session, the cookie comprising a domain session cookie.

13. The system of claim 11, wherein the traffic management virtual server determines that the session is not stored in memory local to the second core.

14. The system of claim 11, wherein the second core decodes the core identifier of the first core encoded in the identifier of the session and identifies the first core as an owner core of the session.

15. The system of claim 11, wherein the second core generates a core-to-core message specifying the identifier of the session.

16. The system of claim 11, wherein the second core receives from the first core the response comprising a failure message identifying that the first core determined the identifier of the session is invalid.

17. The system of claim 11, wherein the second core receives from the first core the response comprising data to create the session on the requesting core.

18. The method of claim 17, wherein the second core creates the session in memory local to the second core.

19. The system of claim 17, wherein the second core determines that a cookie for the session received from the first core, is invalid and responsive to the determination, sending a redirect to the authentication virtual server.

20. The system of claim 11, wherein the second core receives from the first core the response comprising a successful message and responsive to the successful message, performing a local session lookup using the identifier of the session.